| Message ID | 20221013095439.1425108-1-pmanank200502@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | drivers: watchdog: exar_wdt.c fix use after free | expand |
On 10/13/22 02:54, Manank Patel wrote: > fix use after free by storing the result of PTR_ERR(n->pdev) > to a local variable before returning. > > Signed-off-by: Manank Patel <pmanank200502@gmail.com> Reviewed-by: Guenter Roeck <linux@roeck-us.net> > --- > drivers/watchdog/exar_wdt.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/drivers/watchdog/exar_wdt.c b/drivers/watchdog/exar_wdt.c > index 35058d8b21bc..7c61ff343271 100644 > --- a/drivers/watchdog/exar_wdt.c > +++ b/drivers/watchdog/exar_wdt.c > @@ -355,8 +355,10 @@ static int __init exar_wdt_register(struct wdt_priv *priv, const int idx) > &priv->wdt_res, 1, > priv, sizeof(*priv)); > if (IS_ERR(n->pdev)) { > + int err = PTR_ERR(n->pdev); > + > kfree(n); > - return PTR_ERR(n->pdev); > + return err; > } > > list_add_tail(&n->list, &pdev_list);
diff --git a/drivers/watchdog/exar_wdt.c b/drivers/watchdog/exar_wdt.c index 35058d8b21bc..7c61ff343271 100644 --- a/drivers/watchdog/exar_wdt.c +++ b/drivers/watchdog/exar_wdt.c @@ -355,8 +355,10 @@ static int __init exar_wdt_register(struct wdt_priv *priv, const int idx) &priv->wdt_res, 1, priv, sizeof(*priv)); if (IS_ERR(n->pdev)) { + int err = PTR_ERR(n->pdev); + kfree(n); - return PTR_ERR(n->pdev); + return err; } list_add_tail(&n->list, &pdev_list);
fix use after free by storing the result of PTR_ERR(n->pdev) to a local variable before returning. Signed-off-by: Manank Patel <pmanank200502@gmail.com> --- drivers/watchdog/exar_wdt.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)